MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0debe6b083294c2308e8262670203e2c729d71cd2eb5a3927ded4827a2f2ae22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	0debe6b083294c2308e8262670203e2c729d71cd2eb5a3927ded4827a2f2ae22
SHA3-384 hash:	1ef462dfe87b92ae44f9d8e463c2ee9a1511ac0c2de8fcf4b57ce9855f5b666a760725cf3bc4dc596f09a6a475dd8153
SHA1 hash:	d8d5619a2f68fae433d6d1c1e9dcc4d83c733b4c
MD5 hash:	d1268d5a1ee1ee65ac69fe44f56974ec
humanhash:	lake-ohio-wolfram-cat
File name:	Shipping document.zip
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	441'375 bytes
First seen:	2023-02-13 09:49:06 UTC
Last seen:	2023-02-13 09:50:47 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:ESuCxpZrvovxOTMybLeHTu10wBz5szar5:ESuQTQ9o2fa5sg5
TLSH	T1069423B9F229B75C2CA2045BD8504E18C633989077FE7190B4B17BF24F3A6A65CD1673
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla Shipping zip

cocaman

Malicious email (T1566.001)
From: ""Samet KESTEK"<skestek@mutlukal.com.tr>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.136]) "
Date: "13 Feb 2023 03:12:59 +0100"
Subject: "RE: Copy of the Shipping Documents(13.2.2023)"
Attachment: "Shipping document.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Shipping document.exe
File size:	467'456 bytes
SHA256 hash:	9a442ff6604cd89ee5f4fdf085e272ff9b0f3619ebe3b94652ae0c25679c3813
MD5 hash:	61c2d34e955dfb1ab1919c0e5dc4ac43
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_fn5.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63ea07cb6ea97adc8fc0a480/reports/af0a53c2-c266-40ed-951a-3cfa25142587/overview

Verdict:

Malicious

Labled as:

Mal/BredoZp

Link:

https://www.hybrid-analysis.com/sample/0debe6b083294c2308e8262670203e2c729d71cd2eb5a3927ded4827a2f2ae22

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/0debe6b083294c2308e8262670203e2c729d71cd2eb5a3927ded4827a2f2ae22

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0debe6b083294c2308e8262670203e2c729d71cd2eb5a3927ded4827a2f2ae22/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-02-12 23:59:12 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bxv6nmedffgcgchieythaib6frzj24onf222het55vecpixsvyra._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230213-l3yn5abh3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Uses the VBS compiler for execution

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/0debe6b083294c2308e8262670203e2c729d71cd2eb5a3927ded4827a2f2ae22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.